Unhandled Exception in Splunk App for Salesforce: "urllib2.URLError: urlopen error [Errno -2] Name or service not known"

msaltzman_ondec — Thu, 26 Jan 2017 23:16:01 GMT

We are attempting to bring the Splunk App for Salesforce into our on-premise Splunk enterprise. When we configured it, it throws the following error:

01-26-2017 18:05:15.808 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py" Traceback (most recent call last):
01-26-2017 18:05:15.808 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py"   File "/opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py", line 395, in <module>
01-26-2017 18:05:15.809 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py"     run()
01-26-2017 18:05:15.809 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py"   File "/opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py", line 373, in run
01-26-2017 18:05:15.809 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py"     session, endpoint = get_salesforce_token(settings, config)
01-26-2017 18:05:15.809 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py"   File "/opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py", line 227, in get_salesforce_token
01-26-2017 18:05:15.809 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py"     handle = urllib2.urlopen(req)
01-26-2017 18:05:15.809 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py"   File "/opt/splunk/lib/python2.7/urllib2.py", line 154, in urlopen
01-26-2017 18:05:15.809 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py"     return opener.open(url, data, timeout)
01-26-2017 18:05:15.809 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py"   File "/opt/splunk/lib/python2.7/urllib2.py", line 431, in open
01-26-2017 18:05:15.809 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py"     response = self._open(req, data)
01-26-2017 18:05:15.809 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py"   File "/opt/splunk/lib/python2.7/urllib2.py", line 449, in _open
01-26-2017 18:05:15.809 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py"     '_open', req)
01-26-2017 18:05:15.809 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py"   File "/opt/splunk/lib/python2.7/urllib2.py", line 409, in _call_chain
01-26-2017 18:05:15.809 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py"     result = func(*args)
01-26-2017 18:05:15.810 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py"   File "/opt/splunk/lib/python2.7/urllib2.py", line 1240, in https_open
01-26-2017 18:05:15.810 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py"     context=self._context)
01-26-2017 18:05:15.810 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py"   File "/opt/splunk/lib/python2.7/urllib2.py", line 1197, in do_open
01-26-2017 18:05:15.810 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py"     raise URLError(err)
01-26-2017 18:05:15.811 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/splunk-app-sfdc/bin/sfdc_object.py" urllib2.URLError: <urlopen error [Errno -2] Name or service not known>

Unfortunately, this exception is not handled properly, so we don't have insight into what is causing the problem. I tested the username, password, security token, and URL (test.salesforce.com), as well as the request it creates by using those properties, and it is successful. I've even tested using cURL on the server itself without issue. Anyone have some suggestions of what else to look at?

For reference, here's the library that's failing (/opt/splunk/lib/python2.7/urllib2.py):

1180         headers = dict(
1181             (name.title(), val) for name, val in headers.items())
1182
1183         if req._tunnel_host:
1184             tunnel_headers = {}
1185             proxy_auth_hdr = "Proxy-Authorization"
1186             if proxy_auth_hdr in headers:
1187                 tunnel_headers[proxy_auth_hdr] = headers[proxy_auth_hdr]
1188                 # Proxy-Authorization should not be sent to origin
1189                 # server.
1190                 del headers[proxy_auth_hdr]
1191             h.set_tunnel(req._tunnel_host, headers=tunnel_headers)
1192
1193         try:
1194             h.request(req.get_method(), req.get_selector(), req.data, headers)
1195         except socket.error, err: # XXX what error?
1196             h.close()
1197             raise URLError(err)
1198         else:
1199             try:
1200                 r = h.getresponse(buffering=True)
1201             except TypeError: # buffering kw not supported
1202                 r = h.getresponse()

Re: Unhandled Exception in Splunk App for Salesforce: "urllib2.URLError: urlopen error [Errno -2] Name or service not known"

ehaddad_splunk — Thu, 26 Jan 2017 23:55:50 GMT

are you using 2.6.2 version of the app?
when you type index=sfdc is there anything returned?

Re: Unhandled Exception in Splunk App for Salesforce: "urllib2.URLError: urlopen error [Errno -2] Name or service not known"

msaltzman_ondec — Fri, 27 Jan 2017 13:10:02 GMT

Version 2.6.2 is correct. Unfortunately since this exception isn't handled, it kills the script when it's hit. This occurs for all objects and events. Nothing is in the index.

Re: Unhandled Exception in Splunk App for Salesforce: "urllib2.URLError: urlopen error [Errno -2] Name or service not known"

ehaddad_splunk — Fri, 27 Jan 2017 18:36:43 GMT

Looks like it could be a proxy issue. Did you check if you can get to the internet without proxy? Try to telnet from cmd or check browser setting on HWF.

Re: Unhandled Exception in Splunk App for Salesforce: "urllib2.URLError: urlopen error [Errno -2] Name or service not known"

msaltzman_ondec — Fri, 27 Jan 2017 18:48:30 GMT

telnet output:
$ telnet test.salesforce.com 443
Trying 96.43.149.120...
Connected to test.gslb2.salesforce.com.
Escape character is '^]'.

There shouldn't be any proxy in the way afiak, but I don't have a browser installed, since this is a linux system to test. If you recommend it still, I will though.

Re: Unhandled Exception in Splunk App for Salesforce: "urllib2.URLError: urlopen error [Errno -2] Name or service not known"

msaltzman_ondec — Tue, 29 Sep 2020 13:38:28 GMT

Took me a bit, but I solved my own problem. Was a typo in the sfdc.conf file. What it was:

[sfdc_account]
password = ******
server = test.salesforce.com
token = *****
username = ******
proxy_url = None

What it should be:
[sfdc_account]
password = ******
server = test.salesforce.com
token = *****
username = ******
proxy_url =

Thanks to @ehaddad for the clues! It was caused by my automation software adding the text None instead of using it as the null value it represents. Oops 😄

Re: Unhandled Exception in Splunk App for Salesforce: "urllib2.URLError: urlopen error [Errno -2] Name or service not known"

aaraneta_splunk — Tue, 11 Apr 2017 20:08:33 GMT

@msaltzman_ondeck - Glad you were able to find the solution to your question. Please don't forget to click "Accept" to resolve your post. Thanks!

topic Re: Unhandled Exception in Splunk App for Salesforce: "urllib2.URLError: urlopen error [Errno -2] Name or service not known" in All Apps and Add-ons

Unhandled Exception in Splunk App for Salesforce: "urllib2.URLError: urlopen error [Errno -2] Name or service not known"

Re: Unhandled Exception in Splunk App for Salesforce: "urllib2.URLError: urlopen error [Errno -2] Name or service not known"

Re: Unhandled Exception in Splunk App for Salesforce: "urllib2.URLError: urlopen error [Errno -2] Name or service not known"

Re: Unhandled Exception in Splunk App for Salesforce: "urllib2.URLError: urlopen error [Errno -2] Name or service not known"

Re: Unhandled Exception in Splunk App for Salesforce: "urllib2.URLError: urlopen error [Errno -2] Name or service not known"

Re: Unhandled Exception in Splunk App for Salesforce: "urllib2.URLError: urlopen error [Errno -2] Name or service not known"

Re: Unhandled Exception in Splunk App for Salesforce: "urllib2.URLError: urlopen error [Errno -2] Name or service not known"